@inproceedings{carrier:event-based,
  title="An Event-Based Digital Forensic Investigation Framework",
  author="Brian D. Carrier and Eugene H. Spafford",
  booktitle="Digital Forensics Research Workshop",
  year=2004,
  url="http://www.digital-evidence.org/papers/dfrws_event.pdf"
}


@misc{encase,
  author= "{Guidance Software, Inc.}",
  title = "{EnCase Forensic}",
  year=2007,
  url = "http://www.guidancesoftware.com/products/ef_index.asp"}
}

@Misc{encase-3.0,
  title =        "{EnCase} version 3.0 Manual Revision 3.18",
  author =       "Richard Keightley",
  year =         "2003",
  publisher =    "Guidance Software",
  url="http://www.guidancesoftware.com/"
}

@misc{safeback,
  title="SafeBack Bit Stream Backup Software",
  author={NTI Forensics Source, BAE Systems},
  url="http://www.forensics-intl.com/safeback.html",
  year=2008
}



@inproceedings{pyflag,
 title = "PyFlag: An advanced network forensic framework",
 author = "M. I. Cohen",
 booktitle="Proceedings of the 2008 Digital Forensics Research Workshop",
   url="http://www.pyflag.org",
   publisher="DFRWS",
   year=2008,
   month=Aug,
   location="Baltimore, MD"
}

@inproceedings{garfinkel:aff,
  author="Simson L. Garfinkel and David {J.} Malan and Karl-Alexander Dubec and Christopher {C.} Stevens and Cecile Pham",
  title="Disk Imaging with the Advanced Forensic Format, Library and Tools",
  year="2006",
  month=Jan,
  booktitle="Research Advances in Digital Forensics (Second Annual IFIP WG 11.9 International Conference on Digital Forensics)",
  publisher="Springer"
}

@inproceedings{schatz:sdeb,
  title="An information architecture for digital evidence integration",
  author="Bradley L. Schatz and Andrew Clark",
  booktitle="Australian Security Response Team Annual Conference",
  year=2006,
}

@article{garfinkel:affcrypto,
  author="Simson L. Garfinkel",                    
  title="Providing Cryptographic Security and Evidentiary Chain-of-Custody with the Advanced Forensic Format, Library, and Tools",
  journal="The International Journal of Digital Crime and Forensics",
  volume=1,
  issue=1,
  month=Jan # "--" # Mar,
  year=2009
  }
  
@misc{ilook,
  title="ILook Investigator",
  url="http://ilook-forensics.org",
  year=2008,
  publisher={US Department of the Treasury},
  key="US Treasury"
}
 
@techreport{zip-format,
   title="{APPNOTE.TXT} --- {.ZIP} File Format Specification",
   year=2007,
   month=Sep # " 28",
   url="http://www.pkware.com/documents/casestudies/APPNOTE.TXT",
   institution="PKWare, Inc.",
   author="Phil Katz"
}






@Misc{webdav-rfc,
  OPTkey = 	 {},

  author = {Y. Goland and E. Whitehead A. Faizi and S. Carter and
  D. Jensen },

  title = 	 {{RFC 2518}: {HTTP Extensions for Distributed Authoring -- WEBDAV}},
  OPThowpublished = {},
url = {http://www.ietf.org/rfc/rfc2518.txt},
  month = 	 {February},
  year = 	 {1999},
  OPTnote = 	 {},
  OPTannote = 	 {}
}

@Misc{libcurl,
  OPTkey = 	 {},
  author = 	 {Various},
  title = 	 {libcurl - the multiprotocol file transfer library },
  OPThowpublished = {},
url = {http://curl.haxx.se/libcurl/},
  month = 	 { March},
  year = 	 {2009},
  OPTnote = 	 {},
  OPTannote = 	 {}
}

@Misc{HTTP_RFC,
  OPTkey = 	 {},

  author = {R. Fielding and J. Gettys and J. Mogul and H. Frystyk and
  L. Masinter},

  title = 	 {{RFC 2616}: {Hypertext Transfer Protocol -- HTTP/1.1} },
  url = {http://www.w3.org/Protocols/rfc2616/rfc2616.html},
  month = 	 {June},
  year = 	 {1999},
  OPTnote = 	 {},
  OPTannote = 	 {}
}

@misc{RFC1737,
  author =       "K. Sollins and L. Masinter",
  title =        "{RFC 1737}: Functional Requirements for Uniform
                 Resource Names",
  month =        dec,
  year =         "1994",
  bibdate =      "Thu Oct 16 09:34:09 MDT 1997",
  note =         "Status: INFORMATIONAL.",
  acknowledgement = ack-nhfb,
  format =       "TXT=16337 bytes",
  online =       "yes",
  status =       "INFORMATIONAL",
}

@misc{RFC1738,
  author =       "T. Berners-Lee and L. Masinter and M. McCahill",
  title =        "{RFC 1738}: Uniform Resource Locators ({URL})",
  month =        dec,
  year =         "1994",
  bibdate =      "Thu Oct 16 09:34:09 MDT 1997",
  note =         "Updated by RFC1808, RFC2368 \cite{RFC1808,RFC2368}.
                 Status: PROPOSED STANDARD.",
  acknowledgement = ack-nhfb,
  format =       "TXT=51348 bytes",
  online =       "yes",
  status =       "PROPOSED STANDARD",
  updatedby =    "Updated by RFC1808, RFC2368 \cite{RFC1808,RFC2368}.",
}

@misc{RFC4122,
  author =       "P. Leach and M. Mealling and R. Salz",
  title =        "{RFC 4122}: A Universally Unique IDentifier {(UUID)} {URN} Namespace",
  month =        jul,
  year =         "2005",
  note =         "Standards Track",
  url="http://www.ietf.org/rfc/rfc4122.txt"
}

@misc{s3-aws-home-page-money,
  title="Amazon Simple Storage Service (Amazon S3)",
  publisher="Amazon Web services",
  key="Amazon",
  year=2008,
  url="http://aws.amazon.com/s3",
  month=May
}
@misc{libewf,
  title="libewf: Project Info",
  url="http://www.uitwisselplatform.nl/projects/libewf/",
  author="Bas Kloet and Joachim Metz and Robert-Jan Mora and David Loveall and Dennis Schreiber",
  publisher="Uitwisselplatform.NL",
  year=2008
}
                  
@misc{Meijer2006,
  title="Zero Storage Carving",
  month=Nov,
  year=2006,
  journal="Forensics mailing List"
}

@Misc{RFC1808,
  author =       "R. Fielding",
  title =        "{RFC 1808}: Relative Uniform Resource Locators",
  month =        jun,
  year =         "1995",
  bibdate =      "Thu Oct 16 09:34:09 MDT 1997",
  note =         "Updates RFC1738 \cite{RFC1738}. Updated by RFC2368
                 \cite{RFC2368}. Status: PROPOSED STANDARD.",
  acknowledgement = ack-nhfb,
  format =       "TXT=34950 bytes",
  online =       "yes",
  status =       "PROPOSED STANDARD",
  updatedby =    "Updated by RFC2368 \cite{RFC2368}.",
  updates =      "Updates RFC1738 \cite{RFC1738}.",
}

@Misc{RFC2368,
  author =       "P. Hoffman and L. Masinter and J. Zawinski",
  title =        "{RFC 2368}: The mailto {URL} scheme",
  month =        jul,
  year =         "1998",
  note =         "Updates RFC1738, RFC1808 \cite{RFC1738,RFC1808}.
                 Status: PROPOSED STANDARD.",
  acknowledgement = ack-nhfb,
  format =       "TXT=16502 bytes",
  online =       "yes",
  status =       "PROPOSED STANDARD",
  updates =      "Updates RFC1738, RFC1808 \cite{RFC1738,RFC1808}.",
}

@Article{Cohen2007,
  author = 	 { M.I. Cohen},
  title = 	 {Advanced carving techniques},
  journal = 	 {Digital Investigation},
  year = 	 {2007},
  OPTkey = 	 {},
  volume = 	 {4},
  number = 	 {3-4},
  pages = 	 {119-128},
  month = 	 {September-December},
  OPTnote = 	 {},
  OPTannote = 	 {}
}

@inproceedings{1363239,
 author = {Cohen, Michael I.},
 title = {Advanced JPEG carving},
 booktitle = {e-Forensics '08: Proceedings of the 1st international conference on Forensic applications and techniques in telecommunications, information, and multimedia and workshop},
 year = {2008},
 isbn = {978-963-9799-19-6},
 pages = {1--6},
 location = {Adelaide, Australia},
 publisher = {ICST (Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering)},
 address = {ICST, Brussels, Belgium, Belgium},
 }

@misc{pyflag_raid,
  title="Howto load a RAID set into PyFlag",
  author="Michael Cohen",
  year=2008,
  url="http://www.pyflag.net/cgi-bin/moin.cgi/RaidHowTo" 
}
@Book{Tanenbaum2008,
  author = 	 {Andrew S. Tanenbaum},
  ALTeditor = 	 {},
  title = 	 {Modern Operating Systems},
  publisher = 	 {Prentice Hall},
  year = 	 {2008},
  OPTkey = 	 {},
  OPTvolume = 	 {},
  OPTnumber = 	 {},
  OPTseries = 	 {},
  OPTaddress = 	 {},
  OPTedition = 	 {},
  OPTmonth = 	 {},
  OPTnote = 	 {},
  OPTannote = 	 {}
}

